Skip to content
Heedeo
Heedeo

Connect your app

Until your first event arrives, Home (https://app.heedeo.com/review) is the setup, in four steps: your site, Add Heedeo, a check of a real signup, and Your own domain. Add Heedeo has two routes, Agent setup and Manual setup, and both end in the same live check of the browser call and the server call, each ticking off with what Heedeo saw. The first event says you’re set up and leads on to your own domain (section 2), which stays open until an identification comes through it.

Agent setup. Copy the line on Home into your coding agent:

Set up Heedeo in this app: https://app.heedeo.com/SKILL.md

The line holds no key. Your agent studies your app and asks how you want to handle signups (section 5): let Heedeo decide, set your own rules or just watch. On your own rules it asks what you want to catch (repeat signups, aliases and extra accounts, proxies and VPNs, disposable email addresses), and on either of the first two what a caught signup should meet: refuse it, ask them to verify, or hold it for review. It then shows you a plan you can change. Your answers only change the code it writes in your app. Heedeo stores nothing of them and enforces nothing.

  • For your keys, your agent sends you a link and a code. Sign in, check who is asking (the page shows the address, country and tool that started the request, how long ago, and the project name as the request gave it), type the code your agent gave you, and choose Connect.
  • The page does not show the code and does not connect without it, so a link someone else sends you cannot hand them a key in one click. Only type a code from an agent you just asked. A code works once, for 5 minutes.
  • Your agent then writes both keys to .env.local and keeps that file out of git. The secret goes to the file, not into your chat.
  • Each connection makes a new secret key. Keys your app already uses keep working, and each key a connection made is listed on API keys with its own Revoke.

Manual setup. Choose Manual setup on Home’s setup and follow the three steps:

  1. The .env.local lines. The secret is masked until you show it, and is shown on that first visit only; Rotate on API keys makes a new one.
  2. On your signup page: load the JavaScript agent (quick start) with the script tag, or npm install @heedeo/[email protected] and createHeedeo({ publishableKey }), then identify() at the action, with its token sent along with the signup. Choose the tag or the package in one place and both pieces follow. It loads from Heedeo’s own address, with no route and no DNS.
  3. On your server: evaluate({ token, action: "signup", email }) on your server, as a whole signup route, with no request and no client IP. Home shows the route for each path as a tab (section 5): Let Heedeo decide refuses what Heedeo flags, Set my own rules holds one check for each thing you might catch, and Just watch records every signup and refuses no one.

Then Home’s last step, Your own domain: section 2, before you go live.

The sections below are those steps in full.